ssri upgrade - security advisory

[FrailWords]

There's a security advisory to upgrade ssri to >= 5.2.2 (right now it is at 5.0.0).

https://nodesecurity.io/advisories/565

[alexander-akait]

@FrailWords please recreate this issue in cacache package. it is dependecy

[FrailWords]

@evilebottnawi Looks like there's already an issue there. Apologies for not looking it up first.

zkat/cacache#124

[zkat]

For those dropping in, I wanna note: cacache and anything that uses it is not vulnerable to the issue in this advisory, because it does not use strict mode (which is where the regex happens). Likewise, it's unlikely that anyone using ssri for dealing with npm-compatible SRIs will run into this, because npm itself needs non-strict parsing.

[michael-ciniawsky]

Released in v1.2.3 🎉